CPPA adopts DROP regulations, sets data-broker registration fee at $6,000

The California Privacy Protection Agency on Sept. 26 adopted final regulations establishing the Delete Request and Opt Out Platform (DROP) and approved a $6,000 annual data-broker registration fee, plus payment-processing costs, to fund the registry and the platform’s operation.

The action, taken by a 5–0 roll-call vote, directs staff to file the final rulemaking package with the Office of Administrative Law and to implement a prorated $6,000 access fee for data brokers that begin operating during a calendar year. CPPA attorney Liz Allen told the board that "staff today recommends that the board adopt the modified text of the regulations and authorize staff to submit the DROP rulemaking package to the Office of Administrative Law for approval." The board approved the motion after a brief public comment period.

Why it matters: DROP is intended to give Californians a single way to send deletion and opt-out requests to companies that collect and sell personal information (data brokers). The platform hashes identifiers and returns segmented deletion lists to registrants; CPPA staff and CDT (California Department of Technology) described technical and operational safeguards intended to reduce exposure of plain-text personal information while enabling brokers to locate matches in their own stores.

Key details and timeline: The CPPA advised that DROP is in active development and plans to begin beta testing of the platform’s API in October. Data-broker registrants will receive hashed lists rather than plain-text profiles; the agency intends to require registrants to choose identifier lists that maximize match rates, and to standardize input formats to improve hit rates. The board also approved an access-fee schedule that will start at $6,000 in January and be prorated by $500 for each subsequent month in the same calendar year.

Security and verification: Board members pressed staff about the platform’s threat model. Allen and agency IT representatives said DROP will limit collected fields, hash submitted identifiers using SHA-256, require account verification for brokers, and use login.gov or an alternate third-party method for consumer residency verification. Executive Director Tom Kemp described a multi-layered approach that includes hashed inputs, segmented lists returned to brokers (not full profiles), audit trails and logging, and reliance on state hosting and CDT cybersecurity practices.

Enforcement and audit backstops: The agency emphasized that DROP complements — not replaces — enforcement and an audit regime. CPPA staff noted the Delete Act’s independent-audit requirement for data brokers and said the agency will use complaints, audit reports and enforcement tools if registrants fail to honor deletion requests.

Votes at a glance: The board adopted the DROP regulations and authorized filing with OAL by vote of 5–0. The board separately adjusted the registration and access fees (see related action). The motions were made by board members and carried on roll-call votes.